1 files changed, 19 insertions, 17 deletions

diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index f587aded46b5..9dca4da059b3 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -184,7 +184,10 @@ static const struct super_operations debugfs_super_operations = {
 
 static void debugfs_release_dentry(struct dentry *dentry)
 {
-        kfree(dentry->d_fsdata);
+        void *fsd = dentry->d_fsdata;
+
+        if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT))
+                kfree(dentry->d_fsdata);
 }
 
 static struct vfsmount *debugfs_automount(struct path *path)
@@ -344,35 +347,25 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
 {
         struct dentry *dentry;
         struct inode *inode;
-        struct debugfs_fsdata *fsd;
-
-        fsd = kmalloc(sizeof(*fsd), GFP_KERNEL);
-        if (!fsd)
-                return NULL;
 
         if (!(mode & S_IFMT))
                 mode |= S_IFREG;
         BUG_ON(!S_ISREG(mode));
         dentry = start_creating(name, parent);
 
-        if (IS_ERR(dentry)) {
-                kfree(fsd);
+        if (IS_ERR(dentry))
                 return NULL;
-        }
 
         inode = debugfs_get_inode(dentry->d_sb);
-        if (unlikely(!inode)) {
-                kfree(fsd);
+        if (unlikely(!inode))
                 return failed_creating(dentry);
-        }
 
         inode->i_mode = mode;
         inode->i_private = data;
 
         inode->i_fop = proxy_fops;
-        fsd->real_fops = real_fops;
-        refcount_set(&fsd->active_users, 1);
-        dentry->d_fsdata = fsd;
+        dentry->d_fsdata = (void *)((unsigned long)real_fops |
+                                DEBUGFS_FSDATA_IS_REAL_FOPS_BIT);
 
         d_instantiate(dentry, inode);
         fsnotify_create(d_inode(dentry->d_parent), dentry);
@@ -635,8 +628,17 @@ static void __debugfs_remove_file(struct dentry *dentry, struct dentry *parent)
 
         simple_unlink(d_inode(parent), dentry);
         d_delete(dentry);
-        fsd = dentry->d_fsdata;
-        init_completion(&fsd->active_users_drained);
+
+        /*
+         * Paired with the closing smp_mb() implied by a successful
+         * cmpxchg() in debugfs_file_get(): either
+         * debugfs_file_get() must see a dead dentry or we must see a
+         * debugfs_fsdata instance at ->d_fsdata here (or both).
+         */
+        smp_mb();
+        fsd = READ_ONCE(dentry->d_fsdata);
+        if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)
+                return;
         if (!refcount_dec_and_test(&fsd->active_users))
                 wait_for_completion(&fsd->active_users_drained);
 }